{"id":155278,"date":"2026-01-26T11:12:14","date_gmt":"2026-01-26T09:12:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya"},"modified":"2026-01-26T11:12:14","modified_gmt":"2026-01-26T09:12:14","slug":"login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","title":{"rendered":"Sisendi, t\u00fchik, sidekriips, root. Telneti viga v\u00f5imaldab arvutit paroolita h\u00f5ivata","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GNU InetUtils paketis esinev haavatavus m\u00f5jutab k\u00f5iki versioonide vahelisi 1.9.3 kuni 2.7, sealhulgas.<\/p>\n

Tundub, et telnet on ammu minevikku j\u00e4\u00e4nud koos modemite ja dial-up'iga, kuid just tema on \u00e4kitselt t\u00f5sise haavatavuse allikaks saanud. GNU InetUtils'is avastati viga, mis v\u00f5imaldab sisse logida root'ina paroolita, lihtsalt saates kohandatud keskkonnamuutuja v\u00e4\u00e4rtuse.<\/p>\n

Probleem puudutab telnetd serverit, mis kuulub GNU InetUtils'i koosseisu. See edastab login programmile v\u00e4\u00e4rtuse USER, mis on saadud kliendilt, ilma igasuguse kontrollita. Seda saab \u00e4ra kasutada, kui klient saadab stringi \"-f root\" USERina ja \u00fchendub telnet -a v\u00f5i -login parameetriga. Tulemusena t\u00f5lgendab login seda teenusena, vahele j\u00e4tab tavalise autentimisprotseduuri ja autoriseerib automaatselt kasutaja root-ina.<\/p>\n

Haavatavus sai identifikaatori CVE-2026-24061 ja CVSS hindeks 9.8. Ohus on k\u00f5ik GNU InetUtils versioonid alates 1.9.3 kuni 2.7, sealhulgas. Vigade projekt on olnud olemas peaaegu 11 aastat, alates maist 2015, kuid avastati alles n\u00fc\u00fcd. Tegelikult on see klassikaline n\u00e4ide vanakooli haavatavusest, kus ohtlik string edastatakse filtrimata s\u00fcsteemitegevusele root \u00f5igustega.<\/p>\n

Advisory autorid soovitavad kategooriliselt telnetd mitte kasutada, piirata juurdep\u00e4\u00e4su telnet-portile ainult usaldusv\u00e4\u00e4rsetele klientidele ja v\u00f5imalikult kiiresti installida paranduse v\u00f5i v\u00e4rskendada versioonile, kus probleem on lahendatud. Ajutiseks lahenduseks v\u00f5ib olla telnetd t\u00e4ielik v\u00e4ljal\u00fclitamine v\u00f5i kohandatud login versiooni kasutamine, mis ei toeta parameetrit \"-f\".<\/p>\n

Haavatavuse avastas uurija Carlos Cortes Alvarez. Patcher valmis ja t\u00e4iustatud GNU InetUtils'i arendajate poolt jaanuaris 2026. Parandused h\u00f5lmavad k\u00f5igi muutuja sanitiseerimist, mida kasutatakse login kutse k\u00e4su vormimisel, et sarnased r\u00fcnnakud muutuksid p\u00f5him\u00f5tteliselt v\u00f5imatuks.<\/p>\n

Lugu tundub peaaegu s\u00fcmboolne: aegunud protokoll, unustatud teenus ja klassikaline loogiline viga viisid s\u00fcsteemi t\u00e4ieliku kompromiteerimiseni. Veel \u00fcks meeldetuletus, et isegi \"vana\" tehnoloogia v\u00f5ib olla t\u00f5eline oht, kui see endiselt tootmisringkonnas t\u00f6\u00f6tab.<\/p>\n

Otse kohe p\u00e4rast haavatavuse teadete avaldamist k\u00e4ivitasid teadlased honeypot-andurid, et j\u00e4lgida tegelikke ekspluateerimise katseid. R\u00fcndajad ei lasknud end kaua oodata. 18 tunni jooksul tuvastati 60 sissetungimise katset 18 unikaalselt IP-aadresse<\/a>. Censys'i andmete kohaselt olid potentsiaalselt haavatavad ligikaudu kolm tuhat s\u00fcsteemi \u00fcle kogu maailma, kuigi m\u00e4rkimisv\u00e4\u00e4rne osa neist on t\u00f5en\u00e4oliselt samuti honeypot-l\u00f5ksud.<\/p>\n

Katsutud liikluse anal\u00fc\u00fcs n\u00e4itas \u00fcsna kirju pilti. K\u00f5ige aktiivsem oli r\u00fcndaja aadressilt 178.16.53.82, kes viis l\u00e4bi 12 seanssi 10 erineva sihtm\u00e4rgi vastu. Tema tegevus oli t\u00e4ielikult automatiseeritud: juurdep\u00e4\u00e4su saamisel k\u00e4ivitati standardkommandide komplekt nagu uname -a, id, \/proc\/cpuinfo ja \/etc\/passwd lugemine. Erakordne joon oli k\u00e4skude v\u00e4ljundi \u00fcmbersidumine spetsiaalsete markeritega j\u00e4rgnevaks parsimiseks, mis n\u00e4itab selgelt botnetti v\u00f5i automatiseeritud andmete kogumise s\u00fcsteemi.<\/p>\n

Rikkam oli r\u00fcndaja aadressilt 216.106.186.24. Ta keskendus konkreetsele alamv\u00f5rgule ja \u00fcritas seadistada SSH-v\u00f5tit p\u00fcsivaks juurdep\u00e4\u00e4suks, samuti laadida ja k\u00e4ivitada v\u00e4lisserverilt Python-skripti \u2014 t\u00f5en\u00e4oliselt kr\u00fcptovaluuta kaevandamiseks v\u00f5i botnetiks m\u00f5eldud pahavara. T\u00f5si, m\u00f5lemad katsed eba\u00f5nnestusid: sihts\u00fcsteemis ei eksisteerinud kausta .ssh ning puudusid curl ja python.<\/p>\n

Erilist huvi pakuvad kaks r\u00fcndajat aadressidelt 167.172.111.135 ja 165.22.30.48. Erinevalt teistest ei \u00fcritanud nad kohe saada root-\u00f5igusi, vaid katsetasid kontode, nagu nobody, daemon ja isegi olematute nonexistent123, kasutamist. Seansside vahelised viivitused ja tegevuste loogika viitavad elavale inimesele klaviatuuri taga. T\u00f5en\u00e4oliselt on need kogenumad h\u00e4kkerid, kes on teadlikud sissetungi avastamise s\u00fcsteemidest ja omavad tehnikat privileegide t\u00f5stmiseks.<\/p>\n

M\u00f5ned r\u00fcndajad demonstreerisid t\u00e4helepanuv\u00e4\u00e4rset hooletust operatiivturbe osas. N\u00e4iteks kasutas kurjategija aadressilt 67.220.95.16 sama IP-d nii ekspluateerimiseks kui ka pahatahtlike programmide serveri majutamiseks. Teised paljastasid oma hostide nimesid juhuslikult muutuja DISPLAY kaudu: \u00fcks t\u00f6\u00f6tas s\u00fcsteemist nimega MiniBear, teine \u2014 virtuaalsest masinast shared-vm2.localdomain, kolmas aga \u00fchendus otse Kali Linuxi t\u00e4ielikust graafilisest keskkonnast.<\/p>\n

Kokkuv\u00f5ttes oli r\u00fcndajate oskuste tase \u00fcsna madal. 18 r\u00fcnnakuallikast vaid m\u00f5ned n\u00e4itasid professionaalsuse m\u00e4rke. Enamiku kasutati lihtsamaid automatiseeritud t\u00f6\u00f6riistu v\u00f5i lihtsalt kl\u00f5bistati klaviatuurile, j\u00e4rgides internetist leitud juhiseid. Sissetungi avastamise s\u00fcsteem Suricata tuvastas edukalt hetke, mil \u00fcks r\u00fcndajatest sai root-juurdep\u00e4\u00e4su, mis kinnitab veel kord mitmekihilise kaitse ja v\u00f5rgu liikluse j\u00e4lgimise t\u00e4htsust.<\/p>\n

Uurijad m\u00e4rgivad, et see haavatavus, \u00fchelt poolt, andis v\u00f5imaluse hobi-h\u00e4kkeritele harjutamiseks, kuid teisalt v\u00f5imaldas turbespetsialistidel koguda v\u00e4\u00e4rtuslikku teavet tegevusviiside ja h\u00f5ivatud t\u00f6\u00f6riistade kohta.<\/p>\n

<\/p>\n

Rohkem: https:\/\/www.securitylab.ru\/news\/568478.php<\/a><\/p>\n

<\/noindex><\/noindex><\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GNU InetUtils \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.9.3 \u043f\u043e 2.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, telnet \u0434\u0430\u0432\u043d\u043e \u0443\u0448\u0435\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u0438 dial-up, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u043e \u0441\u0442\u0430\u043b \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 GNU InetUtils \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 root \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f, \u043f\u0440\u043e\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-155278","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sisselogimine, t\u00fchi koht, sidekriips, root. Telneti viga v\u00f5imaldab arvutit paroolita h\u00f5ivata | ProHoster","description":"GNU InetUtils paketi haavatavus m\u00f5jutab k\u00f5iki versioone alates 1.9.3 kuni 2.7 (kaasa arvatud). Tundub, et telnet on ammu haihtunud koos modemite ja dial-upiga, kuid just see muutus \u00e4kki t\u00f5siseks probleemiks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0433\u0438\u043d, \u043f\u0440\u043e\u0431\u0435\u043b, \u0434\u0435\u0444\u0438\u0441, root. \u0411\u0430\u0433 \u0432 telnet \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f | ProHoster","og:description":"\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GNU InetUtils \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.9.3 \u043f\u043e 2.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, telnet \u0434\u0430\u0432\u043d\u043e \u0443\u0448\u0435\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u0438 dial-up, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u043e \u0441\u0442\u0430\u043b \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-26T09:12:14+00:00","article:modified_time":"2026-01-26T09:12:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"155278","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:42:45","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-26 09:12:14","updated":"2026-02-08 20:42:45","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/155278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=155278"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/155278\/revisions"}],"predecessor-version":[{"id":158081,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/155278\/revisions\/158081"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=155278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=155278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=155278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}